---
title: "Rotate a webhook signing secret"
method: POST
path: "/v1/webhooks/applications/{appId}/endpoints/{id}/rotate-secret"
tags: ["Webhook"]
---

# Rotate a webhook signing secret

`POST /v1/webhooks/applications/{appId}/endpoints/{id}/rotate-secret`

## Request

- Base URL: `https://api.prod.keyban.io`
- URL: `https://api.prod.keyban.io/v1/webhooks/applications/{appId}/endpoints/{id}/rotate-secret`
- Auth: API key in header `X-Api-Key`

Mint a new active signing secret (returned ONCE) and deprecate the current one for a grace period during which both are used to sign, so the receiver can swap without dropping deliveries.

## Path parameters

- `appId` string, required
- `id` string, required

## Response `201`

The endpoint with its new signing secret (shown once)

- WebhookEndpointWithSecretDto
  - `id` string, uuid, required: Entity UUID
  - `createdAt` string, date-time, required: Creation date (ISO 8601)
  - `updatedAt` string, date-time, required: Last update date (ISO 8601)
  - `applicationId` string, uuid, required: Application (tenant) that owns this endpoint.
  - `url` string, uri, required: HTTPS URL that receives the deliveries.
  - `eventTypes` string[], required: Event types this endpoint is subscribed to.
  - `enabled` boolean, required: Whether deliveries are currently sent to this endpoint.
  - `secret` string, required: Standard Webhooks signing secret (`whsec_<base64>`). Returned ONCE at creation or rotation and never again — store it now. The receiver verifies the `webhook-signature` header with it (e.g. the `standardwebhooks` library).

---

[API](https://skmtc.dev/keyban/apis/keyban-rest-apis.md) · [All operations](https://skmtc.dev/keyban/apis/keyban-rest-apis/llms.txt) · [OpenAPI document](https://skmtc.dev/keyban/apis/keyban-rest-apis/revisions/0bb79a1da961?raw)